Summary

This article will be updated as additional information becomes available. Please check back here regularly for updates and new FAQ.

This article discusses the impact of the recently disclosed processor vulnerabilities, named “Spectre” and “Meltdown,” for Windows customers. This article also provides resources to help keep your devices protected at home, at work, and across your enterprise.

Microsoft is aware of new hardware processor vulnerabilities that are named Spectre and Meltdown. These are a newly discovered class of vulnerability based on a common chip architecture that, when originally designed, was created to speed up computers. The technical name is “speculative execution side-channel vulnerabilities.” You can learn more about these vulnerabilities at Google Project Zero.

Steps to help protect your Windows devices

You will need to update both your hardware and your software to address this vulnerability. This includes applicable firmware updates from device manufacturers and, in some cases, updates to your antivirus software as well. We encourage you to keep your devices up-to-date by installing the monthly security updates.

To receive all available protections, follow these steps to get the latest updates for both software and hardware.

Check that you’ve installed the latest Windows operating system security update from Microsoft. If automatic updates are turned on, the updates should be automatically delivered to you, but you should still verify that they’re installed. For instructions, see Windows Update: FAQ

Install available hardware (firmware) updates from your device manufacturer. All customers will have to check with their device manufacturer to download and install their device specific hardware update. See the "Additional resources" section for a list of device manufacturer websites

Note

Customers should install the latest Windows operating system security updates from Microsoft to take advantage of available protections. Antivirus software updates should be installed first. Operating system and firmware updates should follow. We encourage you to keep your devices up-to-date by installing the monthly security updates.

Affected chips include those that are manufactured by Intel, AMD, and ARM. This means that all devices that are running Windows operating systems are potentially vulnerable. This includes desktops, laptops, cloud servers, and smartphones. Devices that are running other operating systems, such as Android, Chrome, iOS, and MacOS, are also affected. We advise customers who are running these operating systems to seek guidance from those vendors.

At the time of publication, we had not received any information to indicate that these vulnerabilities have been used to attack customers.

Starting in January 2018, Microsoft released updates for Windows operating systems and the Internet Explorer and Edge web browsers to help mitigate these vulnerabilities and help to protect customers. We also released updates to secure our cloud services. We continue working closely with industry partners, including chip makers, hardware OEMs, and app vendors, to protect customers against this class of vulnerability.

We encourage you to always install the monthly updates to keep your devices up-to-date and secure.

We will update this documentation when new mitigations become available and recommend you check back here regularly.

Starting in March 2018, Microsoft released security updates to provide mitigations for devices running the following x86-based Windows operating systems. Customers should install latest Windows operating system security updates to take advantage of available protections. We are working to provide protections for other supported Windows versions but do not have a release schedule at this time. Please check back here for updates. For more information, see the related knowledge base article for technical details and the FAQ below.

Starting in March 2018, Microsoft released security updates to provide mitigations for devices running the following x64-based Windows operating systems. Customers should install latest Windows operating system security updates to take advantage of available protections. We are working to provide protections for other supported Windows versions but do not have a release schedule at this time. Please check back here for updates. For more information, see the related knowledge base article for technical details and the FAQ later in this article.

February 2018 Windows operating system updates

The following security updates provide additional protections for devices running 32-bit (x86) Windows operating systems. Microsoft recommends customers install the update as soon as available. We continue to work to provide protections for other supported Windows versions but do not have a release schedule at this time. Please check back here for updates.

Note: Windows 10 monthly security updates are cumulative month over month and will be downloaded and installed automatically from Windows Update. If you have installed earlier updates, only the new portions will be downloaded and installed on your device. For more information, see the related knowledge base article for technical details and the FAQ below.

January 2018 Windows operating system updates

Starting in January 2018, Microsoft released security updates to provide mitigations for devices running the following x64-based Windows operating systems. Customers should install latest Windows operating system security updates to take advantage of available protections. We are working to provide protections for other supported Windows versions but do not have a release schedule at this time. Please check back here for updates. For more information, see the related knowledge base article for technical details and the FAQ below.

Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

Addressing a hardware vulnerability with a software update presents significant challenges and mitigations for older operating systems and can require extensive architectural changes. We are continuing to work with affected chip manufacturers to investigate the best way to provide mitigations, which may be provided in a future update. Replacing older devices that are running these older operating systems and also updating antivirus software should address the remaining risk .

Note

Products currently out of both mainstream and extended support will not receive these OS updates. We recommend customers update to a supported OS version.

We will not be issuing updates for the following platforms:

Windows operating systems that are currently out of support or those entering end of service (EOS) in 2018

Windows XP-based systems including WES 2009, POSReady 2009

Although Windows XP-based systems are affected products, Microsoft is not issuing an update for them because the comprehensive architectural changes required would jeopardize system stability and cause application compatibility problems. We recommend that security-conscious customers upgrade to a newer supported operating system to keep pace with the changing security threat landscape and benefit from the more robust protections that newer operating systems provide.

Updates to Windows 10 for HoloLens are available to HoloLens customers through Windows Update.

After applying the February 2018 Windows Security Update HoloLens customers do not need to take any additional action to update their device firmware. These mitigations will also be included in all future releases of Windows 10 for HoloLens.

For your device to be fully protected, you should install the latest Windows operating system security updates for your device and applicable firmware updates from your device manufacturer. These updates should be available on your device manufacturer's website. Antivirus software updates should be installed first. Operating system and firmware updates can be installed in either order.

You will need to update both your hardware and your software to address this vulnerability. You will also need to install applicable firmware updates from your device manufacturer for more comprehensive protection. We encourage you to keep your devices up-to-date by installing the monthly security updates.

In each Windows 10 feature update, we build the latest security technology deep into the operating system, providing defense-in-depth features that prevent entire classes of malware from impacting your device. Feature update releases are targeted twice a year. In each monthly quality update, we add another layer of security, one that tracks emerging and changing trends in malware to make up-to-date systems safer in the face of changing and evolving threats.

Microsoft has been working closely with affected antivirus partners to ensure all customers receive the January Windows security updates as soon as possible. If customers are not being offered January security updates, Microsoft recommends customers contact their antivirus provider directly. Recommendations:

Ensure your devices are up to date with the latest security updates from Microsoft and from your hardware manufacturer. For more info on keeping your device up to date, see Windows Update: FAQ.

Continue to practice sensible caution when visiting websites of unknown origin and do not remain on sites you do not trust. Microsoft recommends all customers protect their devices by running a supported antivirus program. Customers can also take advantage of built-in antivirus protection: Windows Defender for Windows 10 devices, or Microsoft Security Essentials for Windows 7 devices. These solutions are compatible in cases where customers can’t install or run antivirus software.

To help avoid adversely affecting customer devices, the Windows security updates released in January or February, , have not been offered to all customers. For details, see the Microsoft Knowledge Base Article 4072699.

Intel has reported issues with recently released microcode meant to address Spectre variant 2 (CVE 2017-5715 Branch Target Injection) – specifically Intel noted that this microcode can cause “higher than expected reboots and other unpredictable system behavior” and then noted that situations like this may result in “data loss or corruption.” Our own experience is that system instability can in some circumstances cause data loss or corruption. On January 22, Intel recommended that customers stop deploying the current microcode version on impacted processors while they perform additional testing on the updated solution. We understand that Intel is continuing to investigate the potential impact of the current microcode version and encourage customers to review their guidance on an ongoing basis to inform their decisions.

While Intel tests, updates and deploys new microcode, we are making available an out of band update today, KB4078130, that specifically disables only the mitigation against CVE-2017-5715 – “Branch target injection vulnerability.” In our testing this update has been found to prevent the behavior described. For the full list of devices, see Intel’s microcode revision guidance. This update covers Windows 7 (SP1), Windows 8.1, and all versions of Windows 10, for client and server. If you are running an impacted device, this update can be applied by downloading it from the Microsoft Update Catalog website. Application of this payload specifically disables only the mitigation against CVE-2017-5715 – “Branch target injection vulnerability.”

As of January 25, there are no known reports to indicate that this Spectre variant 2 (CVE 2017-5715) has been used to attack customers. We recommend Windows customers, when appropriate, reenable the mitigation against CVE-2017-5715 when Intel reports that this unpredictable system behavior has been resolved for your device.

Yes. While Security Only updates are not normally cumulative, to ensure customers are protected, Microsoft is including the mitigations against these vulnerabilities in the February Security Only updates. These updates also include the updates for AMD-based devices.

No. Security update 4078130 was a specific fix to prevent unpredictable system behaviors, performance issues, and/or unexpected reboots after installation of microcode. Applying the February security updates on Windows client operating systems enables all three mitigations. On Windows server operating systems, you still need to enable the mitigations after proper testing is performed. See Microsoft Knowledge Base Article 4072698 for more information.